In a recent seminal work, Bitansky and Shmueli (STOC '20) gave the first construction of a constant round zero-knowledge argument for NP secure against quantum attacks. However, their construction has several drawbacks compared to the classical counterparts. Specifically, their construction only achieves computational soundness, requires strong assumptions of quantum hardness of learning with errors (QLWE assumption) and the existence of quantum fully homomorphic encryption (QFHE), and relies on non-black-box simulation. In this paper, we resolve these issues at the cost of weakening the notion of zero-knowledge to what is called $ε$-zero-knowledge. Concretely, we construct the following protocols:
- We construct a constant round interactive proof for NP that satisfies statistical soundness and black-box $ε$-zero-knowledge against quantum attacks assuming the existence of collapsing hash functions, which is a quantum counterpart of collision-resistant hash functions. Interestingly, this construction is just an adapted version of the classical protocol by Goldreich and Kahan (JoC '96) though the proof of $ε$-zero-knowledge property against quantum adversaries requires novel ideas.
- We construct a constant round interactive argument for NP that satisfies computational soundness and black-box $ε$-zero-knowledge against quantum attacks only assuming the existence of post-quantum one-way functions.
At the heart of our results is a new quantum rewinding technique that enables a simulator to extract a committed message of a malicious verifier while simulating verifier's internal state in an appropriate sense.
We investigate the existence of constant-round post-quantum black-box zero-knowledge protocols for $\mathbf{NP}$. As a main result, we show that there is no constant-round post-quantum black-box zero-knowledge argument for $\mathbf{NP}$ unless $\mathbf{NP}\subseteq \mathbf{BQP}$. As constant-round black-box zero-knowledge arguments for $\mathbf{NP}$ exist in the classical setting, our main result points out a fundamental difference between post-quantum and classical zero-knowledge protocols. Combining previous results, we conclude that unless $\mathbf{NP}\subseteq \mathbf{BQP}$, constant-round…
We construct a constant-round zero-knowledge classical argument for NP secure against quantum attacks. We assume the existence of Quantum Fully-Homomorphic Encryption and other standard primitives, known based on the Learning with Errors Assumption for quantum algorithms. As a corollary, we also obtain a constant-round zero-knowledge quantum argument for QMA. At the heart of our protocol is a new no-cloning non-black-box simulation technique.
We initiate the study of multi-party computation for classical functionalities (in the plain model) with security against malicious polynomial-time quantum adversaries. We observe that existing techniques readily give a polynomial-round protocol, but our main result is a construction of *constant-round* post-quantum multi-party computation. We assume mildly super-polynomial quantum hardness of learning with errors (LWE), and polynomial quantum hardness of an LWE-based circular security assumption. Along the way, we develop the following cryptographic primitives that may be of independent inter…
Quantum state preparation is an important ingredient for other higher-level quantum algorithms, such as Hamiltonian simulation, or for loading distributions into a quantum device to be used e.g. in the context of optimization tasks such as machine learning. Starting with a generic "black box" method devised by Grover in 2000, which employs amplitude amplification to load coefficients calculated by an oracle, there has been a long series of results and improvements with various additional conditions on the amplitudes to be loaded, culminating in Sanders et al.'s work which avoids almost all ari…
Let L be a language decided by a constant-round quantum Arthur-Merlin (QAM) protocol with negligible soundness error and all but possibly the last message being classical. We prove that if this protocol is zero knowledge with a black-box, quantum simulator S, then L in BQP. Our result also applies to any language having a three-round quantum interactive proof (QIP), with all but possibly the last message being classical, with negligible soundness error and a black-box quantum simulator. These results in particular make it unlikely that certain protocols can be composed in parallel in order to …
We first present a protocol for deterministically distilling non-locality, building upon a recent result of Forster et al. [Phys. Rev. Lett. 102, 120401 (2009)]. Our protocol, which is optimal for two-copy distillation, works efficiently for a specific class of post-quantum non-local boxes, which we term correlated non-local boxes. In the asymptotic limit, all correlated non-local boxes are distilled to the maximally non-local box of Popescu and Rohrlich. Then, taking advantage of a result of Brassard \textit{et al.} [Phys. Rev. Lett. 96, 250401 (2006)] we show that all correlated non-local bo…
In this paper, we extend the protocol of classical verification of quantum computations (CVQC) recently proposed by Mahadev to make the verification efficient. Our result is obtained in the following three steps: $\bullet$ We show that parallel repetition of Mahadev's protocol has negligible soundness error. This gives the first constant round CVQC protocol with negligible soundness error. In this part, we only assume the quantum hardness of the learning with error (LWE) problem similar to the Mahadev's work. $\bullet$ We construct a two-round CVQC protocol in the quantum random oracle model (…
We introduce a fault-tolerant construction to implement a composite quantum operation of four overlapping Toffoli gates. The same construction can produce two independent Toffoli gates. This result lowers resource overheads in designs for quantum computers by more than an order of magnitude. The procedure uses Clifford operations and 64 copies of the non-Clifford gate $T = \exp[i π(I - σ^z) /8]$. Quantum codes detect errors in the circuit. When the dominant source of error is $T$-gate failure with probability $p$, then the composite Toffoli circuit has postselected failure rate of $3072p^4$ to…
The ``N-Box Experiment'' is a much-discussed thought experiment in quantum mechanics. It is claimed by some authors that a single particle prepared in a superposition of N+1 box locations and which is subject to a final ``post-selection'' measurement corresponding to a different superposition can be said to have occupied ``with certainty'' N boxes during the intervening time. However, others have argued that under closer inspection, this surprising claim fails to hold. Aharonov and Vaidman have continued their advocacy of the claim in question by proposing a variation on the N-box experiment, …
Quantum pre- and post-selection (PPS) paradoxes occur when counterfactual inferences are made about different measurements that might have been performed, between two measurements that are actually performed. The 3 box paradox is the paradigm example of such a paradox, where a ball is placed in one of three boxes and it is inferred that it would have been found, with certainty, both in box 1 and in box 2 had either box been opened on their own. Precisely what is at stake in PPS paradoxes has been unclear, and classical models have been suggested which are supposed to mimic the essential featur…
We consider quantum ensembles which are determined by pre- and post-selection. Unlike the case of only pre-selected ensembles, we show that in this case the probabilities for measurement outcomes at intermediate times satisfy causality only rarely; such ensembles can in general be used to signal between causally disconnected regions. We show that under restrictive conditions, there are certain non-trivial bi-partite ensembles which do satisfy causality. These ensembles give rise to a violation of the CHSH inequality, which exceeds the maximal quantum violation given by Tsirelson's bound, $B_{\…
Coherence as a resource for $N$-box and quantum pigeonhole paradoxes
INL – International Iberian Nanotechnology Laboratory（国际伊比利亚纳米技术实验室）；Institute of Theoretical Physics, Ulm University（乌尔姆大学理论物理研究所）；Center for Integrated Quantum Science and Technology (IQST)（集成量子科学与技术中心）；Instituto de Física, Universidade Federal Fluminense（弗鲁米嫩塞联邦大学物理研究所）
The three-box problem is a gedankenexperiment designed to elucidate some interesting features of quantum measurement and locality. A particle is prepared in a particular superposition of three boxes, and later found in a different (but nonorthogonal) superposition. It was predicted that appropriate "weak" measurements of particle position in the interval between preparation and post-selection would find the particle in two different places, each with certainty. We verify these predictions in an optical experiment and address the issues of locality and of negative probability.
We propose a simple protocol for the verification of quantum computation after the computation has been performed. Our construction can be seen as an improvement on previous results in that it requires only a single prover, who is restricted to measuring qubits in the $X$ or $Z$ basis, while requiring only one way communication, from the prover to the verifier. We also show similar constant round protocols with purely classical verifiers are not possible, unless BQP is contained in the third level of the polynomial hierarchy.
Impossibility of Perfectly Complete Many-Round Key Agreement in the QROM
University of Cambridge（剑桥大学）；Shenzhen Research Institute of Big Data（深圳大数据研究院）；Tsinghua University（清华大学）；University of California San Diego（加州大学圣迭戈分校）
It is shown that Popescu-Rohrlich nonlocal boxes (beating the Tsirelson bound for Bell inequality) do exist in the existing structures of both quantum and classical theory. In particular, we design an explicit example of measure-and-prepare nonlocal (but no-signaling) channel being the realization of nonlocal and no-signaling Popescu-Rohrlich box within the generalized probabilistic theory of processes. Further we present a post-selection-based spatially non-local implementation and show it does not require truly quantum resources, hence, improving the previously known results. Interpretation …
Leader election between n parties is known to be impossible classically. This work gives a simple algorithm that does it, based on the weak coin flipping protocol with arbitrarily small bias derived by Mochon in 2007, and recently published and simplified in Aharonov et al in 2016. A protocol with linear number of coin flipping rounds is quite simple to achieve; We further provide an improvement to logarithmic number of coin flipping rounds. This is a much improved journal version of a preprint posted in 2009: many typos are corrected, proofs are more rigorous and accurate, and the analysis of…
